A privilege escalation vulnerability in a script used for network configuration

CVE-2026-44095 is an OS command injection (CWE-78) in a network configuration script shipped on Phoenix Contact CHARX SEC-3000, SEC-3050, SEC-3100, and SEC-3150 EV charging controllers running firmware versions 1.0.0 through 1.9.0. A low-privileged local user — such as the charx-web service account — can inject arbitrary commands into the script, which the system executes as root. The result is full device compromise: confidentiality, integrity, and availability. The fix is firmware 1.9.1, expected no later than August 12, 2026.

The vendor's HIGH / 7.8 rating is honest and nearly right. This CVE is one of 22 flaws disclosed in advisory VDE-2026-008, several of which are unauthenticated remote RCE at CVSS 9.8. CVE-2026-44095 by itself requires local access, which is hard to get on an embedded Linux appliance — but it becomes trivially chainable with any of the five CRITICAL remote-entry CVEs in the same advisory. On its own the 7.8 is slightly generous because local shell access to a purpose-built controller is not the same as local access on a general-purpose server; noisgate adjusts to 7.0 while respecting the OT floor.

Why this verdict

• Local access friction: AV:L means the attacker must already have a shell on the embedded Linux controller. This is not a general-purpose server with user logins — gaining that foothold requires either physical cabinet access or chaining a separate remote CVE.
• No public PoC or exploitation: EPSS is 0.00232, no KEV listing, no known campaigns, and no public exploit code. The attack is currently theoretical.
• Role multiplier (OT/ICS): The CHARX SEC is an EV charging controller — an OT device by definition. Root compromise enables modification of charging parameters, OCPP backend reconfiguration, and potential safety impact. ≥90% of CHARX SEC installs occupy this OT role by definition. The chain succeeds in this role and the blast radius is operational/safety impact per charging station + potential lateral pivot via Ethernet/cellular. This floors the verdict at HIGH.
• Advisory context amplifies risk: This CVE sits alongside 5 CRITICAL remote-entry CVEs (CVSS 9.8) in the same VDE-2026-008 advisory. In practice, CVE-2026-44095 is most dangerous as a chain step after remote compromise — making it a reliable priv-esc primitive once an attacker lands via CVE-2026-7849 or similar.

Why not higher?

CRITICAL would require either unauthenticated remote access (this is local-only) or fleet-scale blast radius from a single exploitation. The Scope is Unchanged — compromise is contained to the individual controller. While chaining with remote CVEs is plausible, the chain's entry-point CVEs are the ones that should carry the CRITICAL rating (and they do, at 9.8). Rating this local priv-esc step as CRITICAL would double-count the remote entry risk.

Why not lower?

MEDIUM would ignore the OT role floor. Root on an EV charging controller is not equivalent to root on a dev sandbox — it controls physical infrastructure and safety-relevant charging behavior. The low complexity (AC:L) and lack of user interaction (UI:N) mean exploitation is reliable once the local prerequisite is met. The presence of five remote-entry CVEs in the same advisory makes the local-access prerequisite less protective than it appears in isolation.

1. Network-isolate all CHARX SEC controllers behind a dedicated OT firewall — The vendor explicitly states these devices are designed for closed networks. Enforce this by placing all CHARX controllers on a dedicated VLAN with no inbound access from IT networks or the internet. This neutralizes the remote-entry CVEs that make this local priv-esc chainable. Deploy within 30 days per the noisgate mitigation SLA for HIGH.
2. Restrict and audit local accounts on the controller — Remove or disable any unnecessary local user accounts. Change default credentials if any exist. Monitor SSH access logs (if available) for anomalous logins. This raises the bar for the PR:L prerequisite.
3. Monitor OCPP backend for configuration anomalies — If the controller's OCPP backend connection changes unexpectedly, or charging parameters are modified outside maintenance windows, treat it as a compromise indicator. This provides indirect detection of post-exploitation activity.
4. Apply firmware 1.9.1 as soon as available (ETA: August 12, 2026) — This is the definitive fix for all 22 CVEs in VDE-2026-008. Plan a maintenance window for mid-August. Test on a non-production controller first if possible.

Run this script on the CHARX SEC controller itself via SSH or serial console as any user. Invoke with: bash check_cve_2026_44095.sh. No special privileges required — it only reads the firmware version string.

#!/bin/bash
# check_cve_2026_44095.sh
# Checks if Phoenix Contact CHARX SEC firmware is vulnerable to CVE-2026-44095
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

FIXED_VERSION="1.9.1"

# Try common firmware version file locations on CHARX embedded Linux
FW_VERSION=""
for f in /etc/firmware_version /etc/charx_version /etc/version /data/charx-system-config/version; do
  if [ -f "$f" ]; then
    FW_VERSION=$(cat "$f" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+'| head -1)
    break
  fi
done

# Fallback: try charx CLI if available
if [ -z "$FW_VERSION" ] && command -v charx-info &>/dev/null; then
  FW_VERSION=$(charx-info --version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
fi

if [ -z "$FW_VERSION" ]; then
  echo "UNKNOWN - Could not determine firmware version. Verify manually."
  exit 2
fi

echo "Detected firmware version: $FW_VERSION"
echo "Fixed version: $FIXED_VERSION"

# Compare versions
version_gte() {
  printf '%s\n%s' "$1" "$2" | sort -V | head -1 | grep -qx "$2"
}

if version_gte "$FW_VERSION" "$FIXED_VERSION"; then
  echo "PATCHED - Firmware $FW_VERSION >= $FIXED_VERSION"
  exit 0
else
  echo "VULNERABLE - Firmware $FW_VERSION < $FIXED_VERSION (CVE-2026-44095)"
  exit 1
fi

Sources

1. NVD — CVE-2026-44095
2. CERT@VDE Advisory VDE-2026-008
3. Canadian Centre for Cyber Security — AV26-546
4. VicOne — Pwn2Own Automotive CHARX SEC-3100 RCE Analysis
5. runZero — Finding Affected Phoenix Contact Assets
6. SecurityWeek — ICS Patch Tuesday: Phoenix Contact Fixes
7. Phoenix Contact PSIRT